The vulnerability is a use‑after‑free condition in the list box calculation logic of Foxit PDF products. When the application processes a document, stale references to deleted or re‑created page or form objects may be dereferenced during a calculation, allowing an attacker to craft a document that triggers the routine and potentially execute arbitrary code with the privileges of the PDF reader or editor.

Foxit Software Inc. products Foxit PDF Editor and Foxit PDF Reader are affected. No specific versions are listed, so all installed versions should be considered at risk until an update is applied. The vulnerability exists in both the editor and the reader components and can be triggered by any instance that loads a maliciously crafted PDF.

The CVSS score of 7.8 indicates a high severity. An EPSS score is not available, so the exact likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild as of the data provided. It is inferred that the likely attack vector is a crafted PDF document presented to the user or automatically opened. If a user opens such a document in Foxit PDF Editor or Reader, the use‑after‑free can be triggered, allowing an attacker to execute code with the application's privileges.